55
42
30
55
55
55
55
60
55
42
57
57
30
42
30
55
30
42
55
42
42
60
30
42
55
Measuring the Security of the Evolving Software Supply Chain: a Research Agenda
Researchers propose a unified cross-ecosystem measurement agenda for software supply chain security, targeting dependency modeling and AI-generated dependency patterns.
The paper argues that existing quantitative measurement and vulnerability management approaches for software supply chain security are fragmented and ecosystem-specific, limiting comparable risk assessments. It lays out a research agenda starting with a Systematization of Knowledge to expose gaps in dependency modeling, transitive dependency treatment, and real-world exploitability of vulnerabilities. It further warns that AI-assisted development with coding LLMs will create dependency patterns not captured by traditional Software Composition Analysis tools, motivating a rethink of dependency modeling.
30
42
42
30
55
55
60
30
55
55
60
55
57
60
42